netdev - [PATCH] rionet: Fix refcounting bugs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 28 Mar 2023 12:50:06 +0800
From:   Liang He <windhl@....com>
To:     davem@...emloft.net, edumazet@...gle.com, kuba@...nel.org,
        pabeni@...hat.com, windhl@....com, netdev@...r.kernel.org
Subject: [PATCH] rionet: Fix refcounting bugs

In rionet_start_xmit(), we should put the refcount_inc()
before we add *skb* into the queue, otherwise it may cause
the consumer to prematurely call refcount_dec().
Besides, before the next rionet_queue_tx_msg() when we
meet the 'RIONET_MAC_MATCH', we should also call
refcount_inc() before the skb is added into the queue.

Fixes: 7c4a6106d645 ("rapidio/rionet: fix multicast packet transmit logic")
Signed-off-by: Liang He <windhl@....com>
---
 drivers/net/rionet.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/net/rionet.c b/drivers/net/rionet.c
index fbcb9d05da64..72ccbb1aaf11 100644
--- a/drivers/net/rionet.c
+++ b/drivers/net/rionet.c
@@ -195,17 +195,19 @@ static netdev_tx_t rionet_start_xmit(struct sk_buff *skb,
 		for (i = 0; i < RIO_MAX_ROUTE_ENTRIES(rnet->mport->sys_size);
 				i++)
 			if (nets[rnet->mport->id].active[i]) {
-				rionet_queue_tx_msg(skb, ndev,
-					nets[rnet->mport->id].active[i]);
 				if (count)
 					refcount_inc(&skb->users);
 				count++;
+				rionet_queue_tx_msg(skb, ndev,
+					nets[rnet->mport->id].active[i]);
 			}
 	} else if (RIONET_MAC_MATCH(eth->h_dest)) {
 		destid = RIONET_GET_DESTID(eth->h_dest);
-		if (nets[rnet->mport->id].active[destid])
+		if (nets[rnet->mport->id].active[destid]) {
+			refcount_inc(&skb->users);
 			rionet_queue_tx_msg(skb, ndev,
 					nets[rnet->mport->id].active[destid]);
+		}
 		else {
 			/*
 			 * If the target device was removed from the list of
-- 
2.25.1